diff --git a/app.te b/app.te
index 9101c9b..5ba0e74 100644
--- a/app.te
+++ b/app.te
@@ -419,6 +419,3 @@
   security_file
   tmpfs
 }:lnk_file no_w_file_perms;
-
-# Do not allow Apps to directly open tun_device
-neverallow appdomain tun_device:chr_file open;
diff --git a/bluetooth.te b/bluetooth.te
index 1817820..e74d38d 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -27,6 +27,7 @@
 allow bluetooth self:packet_socket create_socket_perms;
 allow bluetooth self:capability { net_admin net_raw net_bind_service };
 allow bluetooth self:tun_socket create_socket_perms;
+allow bluetooth tun_device:chr_file rw_file_perms;
 allow bluetooth efs_file:dir search;
 
 # proc access.
diff --git a/isolated_app.te b/isolated_app.te
index 4d37b51..c27b547 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -29,6 +29,9 @@
 ##### Neverallow
 #####
 
+# Do not allow isolated_app to directly open tun_device
+neverallow isolated_app tun_device:chr_file open;
+
 # Do not allow isolated_app to set system properties.
 neverallow isolated_app property_socket:sock_file write;
 neverallow isolated_app property_type:property_service set;
diff --git a/untrusted_app.te b/untrusted_app.te
index d5abe17..8672f58 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -178,3 +178,6 @@
     -coredump_file          # userdebug/eng only
   ')
 }:dir_file_class_set { create unlink };
+
+# Do not allow untrusted_app to directly open tun_device
+neverallow untrusted_app tun_device:chr_file open;